From 6ad89c2a3a492c65fb907cea34deca3955530a05 Mon Sep 17 00:00:00 2001
From: Gilles Peskine <Gilles.Peskine@arm.com>
Date: Sat, 10 Aug 2019 17:38:34 +0200
Subject: [PATCH] Exclude DTLS 1.2 only with older OpenSSL
compat.sh used to skip OpenSSL altogether for DTLS 1.2, because older
versions of OpenSSL didn't support it. But these days it is supported.
We don't want to use DTLS 1.2 with OpenSSL unconditionally, because we
still use legacy versions of OpenSSL to test with legacy ciphers. So
check whether the version we're using supports it.
---
tests/compat.sh | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
diff --git a/tests/compat.sh b/tests/compat.sh
index b4d2c524a..88f29843b 100755
--- a/tests/compat.sh
+++ b/tests/compat.sh
@@ -211,14 +211,13 @@ filter_ciphersuites()
G_CIPHERS=$( filter "$G_CIPHERS" )
fi
- # OpenSSL 1.0.1h doesn't support DTLS 1.2
- if [ `minor_ver "$MODE"` -ge 3 ] && is_dtls "$MODE"; then
+ # OpenSSL <1.0.2 doesn't support DTLS 1.2. Check what OpenSSL
+ # supports from the s_server help. (The s_client help isn't
+ # accurate as of 1.0.2g: it supports DTLS 1.2 but doesn't list it.
+ # But the s_server help seems to be accurate.)
+ if ! $OPENSSL_CMD s_server -help 2>&1 | grep -q "^ *-$MODE "; then
+ M_CIPHERS=""
O_CIPHERS=""
- case "$PEER" in
- [Oo]pen*)
- M_CIPHERS=""
- ;;
- esac
fi
# For GnuTLS client -> mbed TLS server,